I see a few issues going on here. First you are taking in parameters to build a dynamic string and you going to end up executing that dynamic sql with no parameters. This is vulnerable to sql injection.

Your big line of dynamic sql has a lot of errors in it.

select @sql = @sql + 'and ','+REPLACE(@system_Status,'','')+',' LIKE '%,'+system_Status+',%''

I think that line should be something like this:

select @sql = @sql + 'and REPLACE(' + @system_Status + ','''','''') LIKE ''%'' + system_Status + ''%'''

You have a replace statement that is used that is doing nothing. Your replace statement is: REPLACE(@system_Status,'','')

Here you are finding nothing and replacing it with nothing. Not sure what you are trying to do there but this isn't going to do anything.

The query you have built is nonSARGable because you have like % VALUE %. That means it will have to scan each and every row to see if meets the criteria.

I think that what you are trying to do here is process a query with a comma delimited list of values? The best approach to this is to first parse that string and then do your evaluations.

You should read the article in my signature about splitting strings. You might also want to take a look at the first link in my signature for best practices when posting questions.